HUBBLE SPACE TELESCOPE 
SERVICING MISSION 3A RENDEZVOUS OPERATIONS 


S. Lee, S. Anandakrishnan, C. Connor, E. Moy, D. Smith 
Lockheed Martin Technical Operations/Greenbelt, MD 

M. Myslinski 

Honeywell Technology Solutions Inc./Greenbelt, MD 

L. Markley, A. Vemacchio 
NASA Goddard Space Flight Center/Greenbelt, MD 


ABSTRACT 

The Hubble Space Telescope (HST) hardware complement includes six gas bearing, pulse rebalanced rate integrating 
gyros, any three of which are sufficient to conduct the science mission. After the loss of three gyros between April 1 997 and 
April 1999 due to a known corrosion mechanism, NASA decided to split the third HST servicing mission into SM3A, 
accelerated to October 1999, and SM3B, scheduled for November 2001. SM3A was developed as a quick turnaround 
"Launch on Need" mission to replace all six gyros. Loss of a fourth gyro in November 1999 caused HST to enter Zero Gyro 
Sunpoint (ZGSP) safemode, which uses sun sensors and magnetometers for attitude determination and momentum bias to 
maintain attitude stability during orbit night. Several instances of large attitude excursions during orbit night were observed, 
but ZGSP performance was adequate to provide power-positive sun pointing and to support low gain antenna 
communications. Body rates in ZGSP were estimated to exceed the nominal 0.1 deg/sec rendezvous limit, so rendezvous 
operations were restructured to utilize coarse, limited life, Retrieval Mode Gyros (RMGs) under Hardware Sunpoint (HWSP) 
safemode. Contingency procedures were developed to conduct the rendezvous in ZGSP in the event of RMGA or HWSP 
computer failure. Space Shuttle Mission STS- 103 launched on December 19, 1999 after a series of weather and Shuttle- 
related delays. After successful rendezvous and grapple under HWSP/RMGA, the crew changed out all six gyros. Following 
deploy and systems checkout, HST returned to full science operations. 

INTRODUCTION 

During normal science operations, the Hubble Space Telescope (HST) employs a set of high-performance, low noise 
Rate Integrating Gyros (RIGs) in conjunction with Fine Guidance Sensors (FGSs) and reaction wheels to provide precision 
pointing with jitter of less than 7 mas (Refs. 1 - 3). The RIGs use a brominated fluorocarbon (BTFE) flotation fluid to 
achieve exceptional noise performance. HST lost three RIGs between April 1997 and April 1999 due to BTFE-caused 
corrosion of flexleads carrying electrical power and signals to the gyros, leaving the vehicle with the minimum complement 
of three RIGs. Failure of any of these gyros would cause HST to enter Zero Gyro Sunpoint (ZGSP) safemode, rendering it 
unable to conduct its science mission. In response to this situation, NASA divided the planned third HST servicing mission 
into two missions: SM3A and SM3B. The primary objective of SM3A, accelerated to October 1999, was to replace all RIGs 
on-board HST. 

With HST under normal mode control with three functioning RIGs, a nominal R-bar rendezvous was planned for SM3A. 
However, on November 13, 1999, a fourth RIG failed due to flexlead failure and HST entered ZGSP. In this mode, HST 
utilized rates derived from Coarse Sun Sensors (CSSs) and the Magnetic Sensing System (MSS) along with CSS position to 
maintain a power positive sunpoint attitude. Momentum bias was established using the reaction wheels to provide gyroscopic 
stiffness during orbit night when sensor data was unavailable. Consideration was given to conducting the rendezvous in 
ZGSP, but expected body rates exceeded the 0.1 deg/sec rendezvous flight rule. However, Shuttle Engineering Simulation 
(SES) training runs demonstrated the crew’s ability to execute a ZGSP rendezvous as a contingency. 

With only two RIGs available, rendezvous in Hardware Sunpoint (HWSP) safemode using the Retrieval Mode Gyro 
Assembly (RMGA) was baselined. HWSP utilizes HST’s secondary computer system with CSSs to provide closed-loop 
sunpoint control. Rate data is provided by the RMGA which houses three coarse, limited-life Retrieval Mode Gyros (RMGs). 
To verify the performance of this control mode, an on-orbit test was conducted on December 3, 1999. Rendezvous with HST 
under HWSP required the crew to execute an orbiter “flyaround” to place HST’s grapple fixtures in position for capture by 
the Orbiter Remote Manipulator System (RMS). 
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To mitigate the uncontrolled vehicle spin-up which would result from a hardover RMGA failure, a ground-based 
monitoring and recovery procedure was developed. This procedure allowed ground controllers to quickly identify a hardover 
failure and command HST to drift mode. Strategies for manual reaction wheel commanding were developed to provide post- 
drift rate damping to allow recovery back to ZGSP. 

STS-103/SM3A launched on December 19, 1999. On Flight Day 3, HST was commanded to HWSP using RMGAs. The 
crew successfully conducted the flyaround maneuver and captured HST on schedule. On Extravehicular Activity (EVA) Day 
1, all six RIGs were replaced by the EVA crew. After two additional EVA days, HST was successfully deployed and shortly 
thereafter resumed science operations. 

NORMAL POINTING CONTROL SYSTEM AND RATE GYROS 
Description of Normal Pointing Control System 

The HST Pointing Control System (PCS) is a multi-rate, multi-loop, discrete time system with multiple modes of 
operation that provides attitude reference, attitude control and stabilization, and maneuverability in support of HST science 
operations and vehicle momentum management. Functional control of the system resides within PCS software modules 
executed by the Flight Computer (see Figure 1). Ground support is required for uplink of data base updates and vehicle 
pointing requirements. The PCS operates in different mission modes to provide both coarse and fine pointing and a stable 
platform for scientific operations. In Normal mode operation, the primary actuators are four skew-mounted Reaction Wheel 
Assemblies (RWAs) and the primary sensors are single degree-of-freedom, fluid floated, gas bearing, Rate Integrating Gyros 
(RIGs). HST contains six RIGs housed in three Rate Gyro Assemblies (RGAs). Any combination of three or four RIGs can 
be used to provide three-axis PCS Normal mode control. Momentum management is accomplished using four magnetic 
torquer bar actuators with local B eart h field sensing provided by redundant, three-axis magnetometers. In the event of major 
failures, a Safing system provides Sunpoint attitude control to allow for HST survival until the system can be restored via 
ground commanding or by component replacement during servicing missions. 

PCS software modules resident in the Flight Computer process the PCS sensor data and command the PCS actuators. 
These software modules provide for the calculation of the PCS control law, attitude updates, the momentum management 
control law, and the command generator. The command generator acceleration and incremental position commands are 
provided to the control system software together with the RGA incremental rate data. The control system uses position, rate, 
and integral compensation, as well as a rate filter to stabilize high frequency bending modes. An estimate of external torque is 
used to eliminate cross-coupling between axes, effectively decoupling the control torques in the vehicle axes, denoted VI, 
V2, and V3. A feedback loop provides an error calculation path to account for variations in parameters, such as the vehicle 
inertia estimate and RWA feed forward gain. 

Disturbance 

PID controller Toraue 



Figure 1: Normal Mode Block Diagram 
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Overview of Rate Gyro Assemblies 

The RGA is a strapdown reference gyro package that senses vehicle motion using two ultra-low noise RIGs to provide 
two-channel digital attitude and analog rate information. The resulting short term attitude and attitude rate data are used 
during normal operations for fine pointing and spacecraft maneuvers. In addition, the RGA is used by the Sating system, for 
attitude and rate information during safe mode operations, provided that the RGAs are not the cause of safemode entry. A 
single RGA is composed of a Rate Sensor Unit (RSU) that houses the RIGs, and an Electronics Control Unit (ECU) that 
contains two independent sets of control electronics. Each RSU/ECU set provides two independent electronic channels and 
RIGs. The RSU and ECU can be replaced during extravehicular activity (EVA) on servicing missions. 

The RGAs are configured , in quantized, pulse rebalance loops. The HST data management system provides an interface 
between the gyros and the flight control computer. The gyros are driven by a two phase hysteresis motor, which is capable of 
maintaining rotor speed on a single phase under certain conditions. However, motor start up is not possible with a single 
phase, and loss of spin motor rotation (run down) will occur with loss of both phases. 

Flexlead Corrosion Failure Mechanism 

The gyroscope used in the RGAs is the 64 PM RIG built by L3 Space and Navigation (L3SN). This gyro is composed of 
a hermetically sealed housing and a float assembly, which contains the gyro wheel, drive motor and torquer coil. The float is 
attached electrically and mechanically to the housing via flexible leads of very small cross section. These flex leads, which 
transport power to the motor, magnetic torquer and signal generator, are composed of a highly conductive alloy. The flotation 
fluid is specially formulated for density match with the float and for viscosity consistent with the required gyro gain. This 
fluid, in the presence of oxygen (possibly introduced during the gyro fill process, or generated by interaction of the fluid with 
the flex leads), is very corrosive to the flex leads (Ref. 4). Over time, at operating current and temperature (which accelerate 
the corrosion process), the flex leads become porous, and structural integrity and current carrying capability are 
compromised. The effect of localized heating, due to the relatively high current in the porous flex leads, is believed 
responsible for the failures. 

Chronology of Flex Lead Related Gyro Failures 

Since HST was launched in April 1990, several on-orbit failures and anomalies have been experienced due to degraded 
flex leads (Table 1). Although five gyros have failed, all five had already achieved operating life expectancy at the time of 
failure. In two cases, the gyros continued to operate following loss of a single motor phase to flex lead failure. However, bias 
instability exceeded operational limits in one of these cases, making rate data unusable for normal science activity. In both of 
these cases, the second phase was lost within months of the first phase failure, due to increased current load in the surviving 
phase. In the other three cases, loss of a single phase resulted in rotor spin down and loss of the gyros. 


Corrective Action 


In response to these failures, L3SN undertook an 
aggressive gyro production program aimed at 
replacement of the failed units during SM3A. The 
gyro fill process was modified to preclude 
introduction of oxygen into the fluid, and the fluid 
was carefully screened to ensure that all parameters 
were well within specification, particularly those 
associated with flex lead corrosion. The program was 
completed as planned and the hardware was ready for 
the SM3A launch. 

Additional reaction to the gyro failures led to 
development of enhanced flex leads, which are 
resistant to corrosion by the the flotation fluid while 
retaining the mechanical and electrical characteristics 
of the original configuration. This ambitious effort Table j . RGA G yro Flex lead Failure History 


Date 

Gyro 

Remarks 

10/7/92 

G6 

Replaced during SM-1, not in control loop 
at time of failure 

4/9/97 

G4 

Telemetered lead (Phase B) failed, resulting 
in rotor spin down. Second phase failed 
within hours. 

7/28/98 

G6 

Phase A failure, motor continued to run 
with significantly increased current on 
single phase, gyro returned to control loop 

10/22/98 

G6 

Phase B failed resulting in rotor spin down. 

1/25/99 

G3 

Phase A failure, motor continued to run 
with significantly increased current on 
single phase, gyro unusable due to bias 
instability 

4/10/99 

G3 

Phase B failed resulting in rotor spin down. 

11/13/99 

G1 

Phase A failure resulted in rotor spin down 
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was made possible through active participation of LMMS and GSFC personnel, in conjunction with L3SN engineers. 
Enhanced flex leads were produced and subjected to accelerated life testing, which has yielded excellent results to date and is 
still in progress. Enhanced flex leads have suffered no failures thus far, while one of the original configuration has failed as 
expected. Enhanced flex leads have also been installed in a first flight gyro, which has yielded nominal data thus far. A 
second gyro is awaiting flex lead installation. These and subsequent units will be available to support SM4 and beyond. 

SERVICING MISSION 3A DECISION 

HST experienced the loss of three RIGs between April 1997 and April 1999. This left the vehicle with the minimum 
complement of three RIGs in a single string configuration. Failure of any remaining gyro would cause HST to enter Zero 
Gyro Sunpoint (ZGSP) safemode, rendering it unable to conduct its science mission. 

Prior to the Gyro 3 phase A flexlead failure in January 1999, plans were underway to conduct the third servicing mission 
to HST in July 2000. The manifest for this servicing mission, named SM-3, included the following: 

- Replacement of all three RSUs 

- Installation of Voltage Improvement Kits (VIKs) 

- Replacement of the existing DF-224 Flight Computer with an Intel 486-based Flight Computer 

- Replacement of Fine Guidance Sensor 2 (FGS-2) 

- Replacement of S-Band Single Access Transmitter 2 (SSAT-2) 

- Replacement of Engineering and Science Tape Recorder 3 (ESTR-3) with Solid State Recorder 3 (SSR-3) 

- Installation of New Outer Blanket Layers (NOBLs) 

- Installation of a new instrument, the Advanced Camera for Surveys (ACS) 

- Installation of new, rigid solar arrays 

- Installation of two cooling systems, the NICMOS Cooling System (NCS) and the Aft Shroud Cooling System (ASCS) 

As a result of the loss of the Gyro 3 phase A flexlead and the possibility of lost HST science, NASA decided to split SM- 
3 into two servicing missions. The first, SM3A, was accelerated to October 1999 as a “Launch-On-Need” mission. The 
primary objective of SM3A, designated STS-103 by the Space Shuttle Program, was to replace all six gyros on-board HST. 
In addition, the VIKs, 486, FGS-2, SSAT-2, SSR-3, and NOBLs were manifested. The remaining hardware from SM-3 was 
manifested for the second mission, SM3B, scheduled for November 2001 . 

NOMINAL RENDEZVOUS PLANS 

Since three gyros were available, initial planning for SM3A baselined a nominal R-bar rendezvous with HST in normal 
mode. Figure 2 provides a graphical representation of the nominal R-bar rendezvous sequence. Throughout this sequence, the 
Orbiter maintains a local vertical attitude with the +Z axis aligned to the R-bar (i.e. Earth nadir). HST conducts a short series 
of two maneuvers to first establish an inertial rendezvous attitude followed by an inertial capture attitude as described below. 

After launch into the HST orbit plane, the Space Shuttle Orbiter conducts a short series of burns to place it in a co-orbit 
with HST. In preparation for rendezvous, HST closes its aperture door, slews its solar arrays to 90 degrees (i.e. in the V1-V2 
plane), and maneuvers to a rendezvous attitude. Figure 3 shows the HST reference frame and depicts the solar arrays at 0 deg. 
This attitude minimizes the impact of plumes from the Orbiter's upward firing, norm-Z Reaction Control System (RCS) jets 
while providing a power-positive sun angle on the HST solar arrays. The rendezvous attitude is an inertial attitude resulting 
in the +V1 axis (i.e. HST boresight) being aligned with R-bar (i.e. Earth nadir) with a roll angle established to place the sun 
in the V1/+V3 half-plane. This attitude effectively "feathers" the solar arrays edge-on to the Orbiter and is established at 59 
degrees prior to orbit noon where the Orbiter reaches its closest norm-Z RCS braking gate. After this point, the orbit switches 
to low-Z RCS mode which avoids firing of the norm-Z jets, eliminating the threat of plume impingement on HST. 

Prior to orbit noon, HST is maneuvered to a capture attitude in preparation for grapple by the Orbiter's Remote 
Manipulator System (RMS). This attitude is defined such that at grapple time, shortly after enter orbit night, the HST -VI 
axis is aligned to the Orbiter +Z axis (i.e. HST's aft bulkhead into the payload bay). In addition, the HST grapple fixtures, 
which are aligned with the -V3 axis, point 52 degrees out-of-plane north, as measured from the anti-sun side of HST (see Fig. 
4). Thus, relative to the rendezvous attitude, capture attitude is achieved by rolling HST by p SO i ar + 52 degrees. This series of 
HST maneuvers optimizes propellant usage by achieving capture without requiring Orbiter attitude maneuvers. 
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Rendezvous Attitude: 
Solar Arrays edge-on 
to orb iter at 59 deg 
prior to orbit noon 


Capture Attitude: 
Roll to align grapple 
fixtures with Orbiter 
RMS (see Fig. 3) 





Figure 2: R-bar rendezvous sequence, zero beta case. 
Inertial frame depiction, not to scale 



Figure 3: Vehicle frame definition 
and CSS fields of view 


R-BAR APPROACH 

(Grapple Attitude Definition) 



Figure 4: Grapple attitude definition 
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RGA GYRO 1 FAILURE AND ZERO GYRO SUNPOINT 

On 11/13/99 a fourth gyro failed due to flexlead corrosion. With only two viable single-axis gyros available, three-axis 
attitude control with gyros alone was not possible. As a result, HST entered Zero Gyro Sunpoint (ZGSP) which ensures a 
power-positive and thermally safe state without the use of rate gyros. HST remained in ZGSP for approximately 570 orbits, 
until SM3A. ZGSP is a robust, long-term safemode requiring no ephemeris information. Since ephemeris and attitude 
knowledge are unavailable while in ZGSP, the high gain antennas are not used and communications are established through 
two hemispherical S-Band antennas. The aperture door is closed at ZGSP entry to preclude the possibility of sunlight down 
the boresight during the initial capture. ZGSP uses a set of five Coarse Sun Sensors (CSSs) which provide 4n steradian 
coverage as illustrated in Figure 3 along with the MSS as attitude sensors. The Reaction Wheel Assembly (RWA) is used for 
primary attitude control, and magnetic torque rods are used for momentum management. 

While HST is in sunlight, ZGSP uses CSS data for position and rate information about the axes perpendicular to the Sun 
line, and the magnetic field vector for rate damping about the Sun line. Vehicle attitude about the Sun line is not actively 
controlled. Since the Earth's magnetic field is not inertially fixed, magnetometer-derived rates are coarse. However, they are 
adequate to maintain rates around the Sun line at an acceptably low level. During orbit night, CSS data is unavailable and 
ZGSP disables active control. As a result, all three axes drift, but the drift away from the Sun line is limited by a momentum 
bias in the direction of the sunpoint axis. This momentum bias is commanded after initial sun capture once sunpoint errors, as 
measured by the primary CSS, have been reduced below a database-specified value. Momentum bias is established in the 
RWAs by using the magnetic torque rods to load the wheels to 250 Nms. For a detailed description of ZGSP see Reference 5. 

During the extended period under ZGSP control prior to SM3A, HST would occasionally Enter Orbit Day (EOD) with a 
large attitude error/excursion (Sun more than 41° from the +V3 axis at EOD) due to drift during orbit night - the uncontrolled 
part of the orbit. Except for one orbit on DOY 1999.350, ZGSP control captured the Sun (defined as the Sun being within 3 
deg of the Sun point, i.e., +V3, axis) within 37 minutes following EOD. During the time that HST was in ZGSP, each orbit 
day was approximately 59 min. long. The DOY 1999.350/17:58 orbit entered orbit day with a large excursion and took 
approximately 57 min to capture the Sun. The large attitude excursions and capture times govern the time it takes the solar 
arrays to fully charge the batteries. While in ZGSP, on average, it took 28.5 min. from EOD for the batteries to reach trickle 
charge, compared to 15-20 min. in Normal mode. The lowest battery State Of Charge (SOC) was as low as 335 A-hr on one 
orbit, but still well above the 225 A-hr SOC safemode threshold. 

While ZGSP met its prime objective of maintaining HST in a power positive and thermally safe state, it was not 
designed for and did not meet the performance requirements for nominal Orbiter rendezvous. The ZGSP HST-STS 
rendezvous option is discussed in detail in the next section. However, the parameter of primary importance for rendezvous is 
HST rates. Due to the large attitude errors at EOD, the transients can be quite large and the rates are quite often not favorable 
for rendezvous. While the vehicle rates, especially about the VI and V2 axes, can be quite low after Sun capture, the time 
between Sun capture and Enter Orbit Night (EON) is not predictable. 

Examination of the orbit night data from the on-orbit test of ZGSP showed that at EON, the largest VI and V2 rate 
magnitudes were less than 0.03 deg/s. However, the V3 rate magnitude could be as high as 0.15 deg/s. This is not 
unexpected, given that the rate about V3 is computed from the measured magnetic field, using the simplifying assumption 
that the Earth's magnetic field and the V3 axis are inertially fixed. The resulting derived rates are inaccurate because the 
Earth's magnetic field describes a roughly conical motion at an average rotation rate of two revolutions per orbit due to 
spacecraft orbital motion. The 5787 sec HST orbit period gives an orbit rate of 0.06 deg/sec and can result in V3 rates as high 
as 0.12 deg/s. In addition, the control is low gain rate damping with a limited torque of 0.3 N-m. 

The rotational motion around V3 does not have any effect on Sun pointing; but can affect drift during eclipse, since the 
total body momentum can be reduced by the body rates, lowering the stiffening effect of the momentum bias. ZGSP relies on 
the magnetic torque rods and the reaction wheels to establish and maintain a wheel momentum bias of 250 N-m-s about the 
V3 axis. However, the magnetic torque rods are ineffective near the South Atlantic Anomaly (SAA) and the wheel 
momentum bias vector at EON may be as much as 30 deg away from the vehicle momentum vector and 50% less than the 
target wheel momentum bias. This can cause the vehicle rate vector to precess about the net momentum vector, resulting in 
the possibility of rates as high as 0.15 deg/s about any axis during the uncontrolled orbit night pass. 
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HST-STS RENDEZVOUS OPTION WITH HST IN ZERO GYRO SUNPOINT 


Following the failure of Gyro 1 and HST entry into safemode, consideration was given to conducting the SM3A 
rendezvous in ZGSP. Nominal Orbiter rendezvous flight rules restrict maximum HST body rate to 0.1 deg/sec during 
rendezvous. However, it became desirable to re-evaluate this restriction to provide options for HST retrieval during SM3A. 

Rendezvous operations with HST in ZGSP require the Orbiter to conduct a "flyaround" to position HST's grapple 
fixtures for RMS capture. The initial Orbiter approach in this case is identical to the nominal R-bar approach until the Orbiter 
reaches 120 ft range at which point the flyaround is initiated. The flyaround is conducted at the mission commander's 
discretion based on the orientation of HST relative to the Orbiter at capture time. The commander flies the Orbiter into a 
position to place either the -VI or +V1 axis into the payload bay. In addition, the — V3 axis is pointed towards the port 
forward region of the payload bay to expose the grapple fixtures for RMS capture. 

To assess the capability of the Orbiter crew to support ZGSP rendezvous, a series of simulations were conducted at 
NASA/JSC using the Shuttle Engineering Simulator (SES). The SES is a six degree-of-freedom, real-time on-orbit simulator 
which includes a full scale aft flight deck and large visual graphical displays for crew training. On November 23, 1999, the 
SM3A crew commander, pilot, and flight engineer/RMS operator conducted a series of three simulated ZGSP rendezvous. 
HST rate profiles were simulated based on results of the 1993 ZGSP on-orbit test. Simulated rates were scaled up by 30% 
from the on-orbit data to provide a reasonable worst-case rate profile. As a result, maximum HST rates of 0.18 deg/sec were 
simulated. 

Figure 5 provides an overview of the HST rate profile measured during the 1993 on-orbit test, scaled up by 30%. Four 
runs were conducted during the November 23 SES session. The first simulated a HWSP rendezvous. The second was selected 
as representative of a typical, low HST rate interval. In this run, the crew accelerated the R-bar approach to arrive at 120 ft 25 
minutes prior to enter orbit night to allow capture shortly after orbit night when lighting conditions are optimal for the RMS 
operator. Flyaround and grapple was successfully completed 12 minutes before sunset. This run demonstrated the feasibility 
to attempt ZGSP grapple prior to enter orbit night although additional propellant was required during low-Z braking 
operations. 

11/23/99 SES - OVERVIEW OF RUNS 2-4 
1993 ZGSP TEST, 30% HIGH RATES 



Figure 5: ZGSP SES Rendezvous Runs 
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The third run utilized a worst-case rate profile during transition from orbit day to orbit night. In this case, a nominally 
timed R-bar approach was executed followed by successful flyaround and capture shortly after enter orbit night. The final run 
simulated a combination of large and changing HST rates during orbit night. Maximum VI rates of -0.085 deg/sec were 
experienced. In this case, due to the large HST roll rate, the grapple pin was rotating away from the RMS. As a result, the 
crew chose to maintain an Orbiter yaw rate of -0.25 deg/sec in free drift at grapple. Again flyaround and grapple operations 
were successful. 

Additional ZGSP simulations were conducted in the weeks leading up to launch of SM3A. In each case the crew 
successfully executed Orbiter flyaround and capture. These simulations demonstrated the feasibility of ZGSP rendezvous. 
Ultimately, however, rendezvous under Hardware Sunpoint (HWSP) with Retrieval Mode Gyro Assemblies (RMGAs) was 
baselined for SM3A due to the lower and more predictable body rates provided. ZGSP rendezvous was retained as a 
contingency in the event of any anomalies which precluded HWSP/RMGA rendezvous. 

HARDWARE SUNPOINT WITH RETRIEVAL MODE GYROS 

Overview of HWSP and RMGAs 

HWSP functionality is contained within the on-board secondary computer system known as the Pointing and Safemode 
Electronics Assembly (PSEA) which operates independently of the primary Flight Computer. The PSEA’s primary purpose is 
to provide autonomous action in the event of a malfunction of the primary Flight Computer. HWSP provides attitude control 
to position the spacecraft at a power positive attitude with the sunline along the +V3 axis and the solar arrays at 90 deg. 
Alternatively, the PSEA can be configured for -VI sunpoint with the solar arrays at 0 deg. In addition, power loads are shed 
by turning off hardware not critical for HWSP operations. 

HWSP consists of a position and rate feedback system to provide immediate response to changes in vehicle attitude. The 
block diagram for HWSP is shown in Figure 6. Attitude sensing is provided by the CSSs. Rate data can be provided either by 
RGAs or by coarse gyros housed in the Retrieval Mode Gyro Assembly (RMGA). The RGAs are the primary gyros used for 
normal operations and measure rates as low as 3.91e-3 deg/sec. The RMGA is provided as a backup rate gyro in the event of 
significant failures of the RGA. The RMGA consists of three limited life, single-axis gyros configured along the vehicle axes 
which can measures coarse rates as low as 7.81e-3 deg/sec. The alignment of the gyros input axes are such that polarity of the 
measured rates are the opposite of vehicle rates. As with other modes, RWAs and MTS provide actuation for HWSP. 



Figure 6: HWSP Block Diagram 
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Pre-SM3A On-Orbit Test of HWSP/RMGA 


With their short life cycle, the RMGA is operated infrequently to measure their drift rate and update the associated bias, 
if necessary. Polarity checkout of the RMGA output had also been performed immediately after launch to ensure proper 
RMGA values. However, prior to SM3A, the RMGA had never been operated in the closed-loop HWSP control system. As a 
result, an orbit test was planned to ensure their performance as a viable configuration for SM3A. The HWSP/RMGA on-orbit 
test was performed on 12/3/99. 

Prior to activating HWSP control, the RMGAs were powered on to assess their performance before committing to 
HWSP. PSEA Testmode was activated to assess the gyro’s performance. Testmode is a pseudo operating mode within the 
PSEA which can be used to monitor hardware interfaces without HWSP entry. RMGA-measured rates were then compared 
with the rate output of the remaining RGA gyros (G2 and G5). This was accomplished by transforming body frame RMGA 
rates into G2 and G5 frame and evaluating the difference with G2 and G5 outputs. The largest error observed was 0.038 
deg/sec with a mean/bias of 0.016 deg/sec. The largest standard deviation was 0.007 deg/sec. RMGA rates during this 
checkout period are shown in Figure 7. Note that body rates were relatively large (maximum of VI = 0.072 deg/sec, V2 = 
0.04 deg/sec, and V3 = 0.064 deg/sec) since the vehicle was still under ZGSP control. Based on this performance, the 
RMGAs were declared functional for the on-orbit test. 

Following completion of testmode, HWSP was 
activated. Since the vehicle was fairly close to the desired 
sunpoint attitude when HWSP was initiated, capture 
occurred almost immediately. Figure 8 shows the body rates 
throughout the test. HWSP performance kept body rates 
relatively low with maximums of VI = 0.048 deg/sec, V2 = 

0.040 deg/sec, and V3 = 0.040 deg/sec. 

Due to the relatively high noise introduced into the 
control law by the RMGA, the RWAs were torqued at a high 
duty cycle in HWSP, and resulted in wheel temperature 
increases. Initial trends indicated a potential for the RWA 
temperatures to eventually exceed their 49°C upper 
operating limit (see Figure 9). As a result, the on-orbit test 
was terminated and the vehicle commanded back to ZGSP 
after two hours as RWA temperatures reached 44 °C. 

Overall, the on-orbit test proved that HST body rates under 
HWSP/RMGA remained well below the 0.1 deg/sec 
rendezvous flight rule. 




RMOA Ratos - HWSP for On-Orbit Tost 





RWAs Eloctrc 





Figure 8: Rates during HWSP On-Orbit Test 


Figure 9: RWA Temps during On-Orbit Test 
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HWSP/RMGA Rendezvous 

In order to support a HWSP/RMGA rendezvous, SM3A timeline changes were necessary based on knowledge of HWSP 
and lessons learned from the on-orbit test. Post-test analysis of RWA temperature trends by the vendor, Honeywell Inc., 
indicated that such high temperatures would not degrade performance. 

The SM3A timeline was modified to reconfigure HST to the desired configuration for HWSP/RMGA rendezvous. This 
configuration included preparing the vehicle for rapid recovery to ZGSP as a contingency for rendezvous. In addition, as the 
Orbiter approaches HST, communication is switched from TDRSS relay to direct Orbiter communications. Vehicle loads are 
reduced and power relays are opened in preparation for receiving external power from the Orbiter after berthing in the 
payload bay. Immediately following grapple, the Orbiter crew commands HST to free drift via aft-flight deck commands to 
prevent the control law from fighting the RMS. 

HWSP/RMGA FAILURE MONITORING AND GROUND-BASED RECOVERY PLANS 
RMGA Hardover Failure Scenario 

Consideration was given to contingency rendezvous strategies in the event of HWSP/RMGA failures or performance 
anomalies. Failure of the PSEA or RMGA zero-output failures would result in HST drift. Procedures were developed to 
rapidly recovery to ZGSP. Although body rates under ZGSP were higher than prescribed by the flight rules, the crew was 
trained to conduct a ZGSP rendezvous as a contingency described previously. However, it was recognized that a hardover 
failure of the RMGA could result in body rates too high to allow expeditious recovery to ZGSP. 

An RMGA hardover failure would manifest itself as saturated positive or negative rate output. The response of the 
HWSP control law would be to command maximum RWA torque in the corresponding axis. The subsequent sequence of 
events is summarized in Figure 10 and described below. 
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Figure 10: RMGA Hardover Rate Profile 
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During phase 1, immediately after the RMGA hardover failure, maximum torque commands are issued by the control 
law. Due to the symmetrical distribution of the RWAs, the result is maximum (0.82 Nm) torque to the RWAs. At the same 
time, momentum unloading attempts to reduce RWA wheel speeds by commanding maximum current to the MTS. This 
phase continues until the RWAs reach 3600 rpm approximately 6.7 minutes after the failure. Phase 2 begins when with the 
engagement of an RWA overspeed protection circuit, which subtracts 0.15-0.17 Nm from the torque command for speeds 
over 3600 rpm.. As wheel speeds approach saturation (6000 rpm) towards the end of this phase, a Safing system RWA 
momentum test declares one RWA failed. This is predicted to occur once wheel speeds reach approximately 5900 rpm. To 
simplify the analysis, this reconfiguration was not assumed. Thus, phase 2 ends 12.1 min after the failure when all RWAs 
saturate at 6000 rpm. During phase 3, all RWAs are saturated and provide no further torque to HST. However, momentum 
unloading continues to attempt to reduce RWA wheel speeds. As a result, HST body rates continue to build in response to 
MTS unloading commands. Left unchecked, this phase continues indefinitely. Thirty seconds are required to establish a lock 
on one of the two C-band antennas, which provide hemispherical coverage. Thus, once body rates exceed 6.0 deg/sec in 
either the V2 or V3 axis, communication with the spacecraft is no longer possible. 


RMGA Hardover Failure Monitoring 


To mitigate the RMGA hardover failure scenario described above, monitoring criteria were established to identify the 
failure and allow disabling of the PSEA. RMGA rates were not monitored directly because certain telemetry formats did not 
cover the full range of RMGA outputs (i.e. T-format limited to 0.25 deg/sec vs full scale range of 1.0 deg/sec). Since the 
response of the HWSP control law would be to command maximum RWA torque in the corresponding axis, RWA torque 
command became the primary monitoring parameter. This approach would also catch any anomaly in the control path which 
resulted in an erroneous, prolonged torque command. 


A baseline criterion of 60 sec was established to preclude inadvertent declaration of an RMGA hardover failure for a 
momentary, nominal RWA torque command saturation in response to environmental disturbances or Enter Orbit Day (EOD) 
excursions. A second criterion was identified to account for any transients experienced during the initial capture under 
HWSP. This second criterion was based on simulations conducted with 50 run cases in HWSP. Each case provided different 
initial body rates and RWA wheel speeds. Results were evaluated to identify the case with the longest saturated RWA torque 
command time. This case is shown in Figure 1 1 with covi “0.10 deg/sec, coyi = -0.16 deg/sec, and (Ov 3 = -0.16 deg/sec, which 
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Figure 1 1 : RWA Speeds HWSP Simulation with Longest RWA Saturation 
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results in saturated RWA torque commands for 460 sec. Therefore, 460 seconds was allowed for saturated RWA torques 
following HWSP initiation. In addition, a third criterion was added to preclude any unidentified failure resulting in slow 
divergence from sun capture. 

The HWSP/RMGA monitoring criteria are summarized below: 

1) Immediately after HWSP initiation, any RWA torque command > 0.70 Nm for 460 sec 

2) Subsequent to initial HWSP capture, any RWA torque command > 0.70 Nm for 60 sec; 

3) Loss of sun presence in CSS3 monitor cell during orbit day 

The response to any of these criteria was to be the immediate commanding of PSEA disable, resultinhg in HST drift. 
Phase 4 of Figure 10 depicts this drift period. Note that, for purposes of this analysis, 20.0 minutes is assumed for PSEA 
disable (to account for potential communications outages and time to implement the PSEA disable command). At the end of 
phase 3, HST body rates are co V i = 2.0 deg/sec, co V 2 = 1.3 deg/sec, and 0) V 3 =1-5 deg/sec. During phase 4, the PSEA is 
disabled and HST is free to drift. However, the RWA overspeed protection circuit remains active applying -0.15 Nm torque 
to each RWA. 44.3 minutes after the failure, the RWA wheel speeds fall back below 3600 rpm and the overspeed protection 
circuit is disabled. At this time, body rates are co V i = 1-7 deg/sec, u) V 2 = 1 .0 deg/sec, and co V 3 = 1.2 deg/sec. 

RWA Speed Management 

ZGSP was originally designed to support capture at HST body rates up to 0.2 deg/sec. Since body rates are expected to 
exceed 0.2 deg/sec following an RMGA hardover failure and subsequent PSEA disable, a method was developed to reduce 
body rates through direct commanding of individual RWA wheel speeds. The method employs the following three stages: 

1) Power Management Stage: Reduce wheel speeds at low torque to prevent bus overvoltage due to detorque power 
return 

2) RWA Momentum Management Stage: Return RWAs to pre-failure speeds 

3) Body Rate Management Stage: Reduce body rates to < 0.2 deg/sec using rates measured by a combination of RMGA 
and RGA gyros 

Power Management Stage: When an RWA is detorqued (i.e. magnitude of wheel speed is reduced), power is returned to 
the main bus as a function of detorque magnitude and wheel speed. Under circumstances of high wheel speeds, large 
detorque magnitude can result in bus voltages which exceed the operational limit of 32.7V. Exceeding 32.7V is not expected 
to damage any hardware (survival limit = 35V), but its effect on hardware operability is unknown. With a minimum HWSP 
load condition of 32A, maximum acceptable detorque power is calculated to be 1046W (32.7V x 32A). To provide system 
margin, 900 W is used as a practical upper limit. As a result, an individual RWA's detorque power is limited to 225W (900 W 
total 4 RWAs). By comparison, an RWA at 6000 rpm detorqued at -0.82 Nm would return 445W to the bus. 

To satisfy the overvoltage restriction, a power management stage has been devised for conditions when one or more 
RWA wheel speed exceeds 3500 rpm. During this stage, RWA wheel speeds are reduced with a limit on the detorque 
command to restrict power returned to the EPS bus. RWA speeds should be reduced by the same amount to reduce the total 
RWA momentum vector magnitude while maintaining its direction. 

The RWA vendor, Honeywell Inc., provided the calibrations for determining RWA power as a function of wheel speed 
and torque command. Based on this spreadsheet, the following table outlines the maximum allowable torque as a function of 
wheel speed: 


GIrwa (rpm) 

^max (Nm) 

P h „, (W) 

4000 

-0.68 

224 

4500 

-0.52 

224 

5000 

-0.42 

225 

5500 

-0.34 

223 

6000 

-0.29 

225 
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Power Management Stage operations consider only the highest speed RWA and assume the same power return for all 
four RWAs. For future operations, it may be possible to refine these limits by calculating a total power return for all four 
RWAs given each individual wheel speed. This would allow higher detorque commands and subsequently reduce the time 
required to damp body rates and recover to ZGSP. Note that to support this stage operationally, the Flight Computer must be 
recovered and configured to allow visibility into the RWA wheel speeds. In addition, any RWAs pulled off-line should be 
powered back on. 

RWA Momentum Management Stage : During this stage, all RWA wheel speeds are commanded to the state at the time 
just prior to the RMGA hardover failure. In other words, total RWA momentum is returned to its value prior to the failure. 
However, residual body rates will exist due to (1) torquer bar application during maximum RWA torque commanding and (2) 
environmental disturbances since the PSEA/RMGA failure. Worst-case residual body rates from torquer bar application were 
calculated to be VI = 0.72 deg/sec, V2 = 0.29 deg/sec, and V3 = 0.29 deg/sec. Note that during this stage RWA wheel speeds 
are low enough (<3500 rpm) to preclude overvoltage conditions on the bus even for maximum detorque. 

If the PSEA is disabled such that residual body rates after the RWA Momentum Management Stage are less than 0.2 
deg/sec per axis, ZGSP can be commanded directly. However, if body rates exceed 0.2 deg/sec per axis, body rates must be 
reduced further prior to commanding ZGSP. 

Body Rate Management Stage: In the event residual body rates after the RWA Momentum Management Stage exceed 
0.2 deg/sec, it is necessary to further reduce body rate. In the Body Rate Management Stage, the remaining RGA and RMGA 
gyros are employed to measure body rate. This is done by formulating a non-orthogonal hybrid RGA-RMGA transformation 
matrix, T RGA-RMGA/Body, whose rows correspond to the row of the appropriate RGA or RMGA transformation matrix. Then: 

® RGA-RMGA = ^RGA-RMGA/Body® Body 

and 

® Body = ^ Body /RGA-RMGA ® RGA-RMGA 

For example, if RGA 2 is to be used with RMGAs 1 and 2: 


1 RGA-RMGA/Body 


-0.526 0 0.851 

-10 0 
0-10 


~® v r 
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1 

o 

_l 


®RGA2 

co v2 

= 

0 0-1 


®RMGA1 

_®V3_ 


1.175 -0.618 0 


L ft) RMGA2 _ 


A tool was developed to provide these hybrid rates in near real-time. The tool imports RGA and RMGA gyro rates and 
applies the appropriate transformation to determine three-axis body rates. Of course, prior to utilizing this method, any 
RMGA failures must be isolated. 


Note that RGA gyros saturate at 0.5 deg/sec while RMGA gyros saturate at 1.0 deg/sec. In the event any gyro is 
saturated, this method can still be applied since the saturated signal will maintain its polarity. In this case, two or more 
iterations of this stage may be necessary to reduce body rates below 0.2 deg/sec per axis. 

SM3A MISSION SUMMARY 


SM3A/STS-103 launched successfully at 00:50 GMT on December 19, 1999. Rendezvous operations commenced at 
Mission Elapsed Time (MET) of 01/16:14 with power-on of the RMGA. As with the on-orbit test, PSEA Testmode was 
activated to assess the RMGA’s performance relative to the remaining RGAs. The largest error observed was 0.041 deg/sec 
with a mean/bias of 0.017 deg/sec. The largest standard deviation was 0.009 deg/sec. Figure 12 shows the RMGA rates 
during this checkout period. Based on this performance, the RMGAs were declared functional for rendezvous operations. 
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Next, at MET 01/18:26, HWSP was initiated. Since this occurred during orbit day, immediate capture was observed with 
residual errors less than 0.36 deg, as measured by CSS #3. After an initial transient, body rates diminished to less than 0.02 
deg/sec (see Fig. 13). The 250 Nms momentum bias that had been established in ZGSP was unloaded by the MTS within 45 
minutes. Coarse attitude determined by ground controllers based on CSS and MTS data indicated that HST was in a stable 
position for capture with the +V1 axis into the payload bay. 
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Figure 12: RMGA Checkout Rates during SM3A 
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Figure 13: HWSP Initiation during SM3A 


HWSP/RMGA performance was monitored continuously throughout the rendezvous. Performance remained nominal 
with no anomalies observed during this period. The Orbiter crew initiated the flyaround as planned on the rendezvous orbit 
leading to successful RMS capture at MET 01/23:44. Following aft flight deck commands to disable HWSP control, RWA 
speeds of less than 100 rpm were observed. HST was then berthed into the payload bay and external power applied from the 
Orbiter. 


On the following day, the first EVA was conducted to replace all RSUs. All RSUs were powered off at 02/19:23. After 
the crew replaced each RSU the new RIGs within it were powered on for an aliveness test. All six gyros powered on 
nominally as indicated by motor current, temperature, and analog rate. Following the EVA, a functional test was conducted 
by maneuvering the orbiter to a local-vertical orientation which put rates on all RIGs. All gyros matched expected rates 
within the 72 deg/hr uncertainty band. The remaining EVAs resulted in the successful installation of VIKs, the 486 Flight 
Computer, FGS-2R, SSAT-2, SSR-3, and NOBLs. 

On Flight Day 7, HST was prepared for release. As planned, the crew unberthed HST and positioned it for release into 
the Bright Earth Avoidance (BEA) sunpoint attitude. This attitude avoids allowing light reflected from the bright Earth to 
enter the boresight. This light contains ultraviolet radiation which can polymerize outgassed monomers from the newly 
installed hardware. Any such polymers in the vicinity of HST’s optics can degrade optical performance. All outgassing is 
completed in 12 days after which bright earthlight can enter the boresight and the BEA attitude restriction no longer applies. 

Following HST positioning for release, the aperture door was opened. As planned, a five minute drift timer was initiated at 
MET 05/22:11:30, 90 seconds before release. This timer kept HST in drift mode for 3.5 minutes after release to allow the 
Orbiter to perform a clearance maneuver prior to active HST control. Software Sunpoint (SWSP) safemode, which uses RIG 
and CSS sensor data under Flight Computer control to maintain a sunpoint attitude, was initiated autonomously as the timer 
expired. Only small transients were observed and all rates were completely damped by MET 05/22:27. Transition back to 
normal mode occurred at 05/22:29. HST resumed full science operations shortly after the 12 day BEA period. The first post- 
mission Early Release Observation (ERO) image revealed previously unresolved detail in NGC 2392, "The Eskimo Nebula." 
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SUMMARY 


A description of the mechanism leading to the loss of three of HST’s six RIG gyros has been presented. The failure of 
these gyros led NASA to plan a Launch-On-Need HST servicing mission, SM3A. Loss of a fourth gyro caused HST to enter 
ZGSP forcing a change in SM3A rendezvous strategy. Baseline plans for rendezvous in HWSP/RMGA were established with 
ZGSP available as a contingency. Procedures were developed to monitor HWSP/RMGA performance and recover to ZGSP 
even if hardover RMGA failures were encountered. Rendezvous for the STS-103/SM3A mission conducted in December 
1999 was successful leading to the changeout of all RSUs. Following deployment, HST resumed its astronomical science 
mission. 
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